Privacy Policy - Oatly AB

At Oatly we believe in the importance of protecting personal information and an individual’s right to privacy and integrity.

This privacy policy explains how we collect and use your personal data when you are applying for job at Oatly or is otherwise in a recruitment process with Oatly; either for an announced open position or by submitting an unsolicited application.

You are always welcome to contact us if you have any questions.

Who is responsible for the personal data we collect? The Oatly company that you are looking for employment with is the data controller responsible for the processing of personal data described in this privacy policy. Below in this document you find the relevant Oatly company and its contact details, as well as the relevant supervisory authority and its contact details.

What is personal data and what constitutes the processing of personal data? Personal data refers to any information that can be linked directly or indirectly (together with other information) to a natural, living person. This means that information such as name, contact details, images and CV data is classified as personal data if it can be linked to a natural person.

Any action taken with personal data is called processing, regardless of whether it is carried out in an automated manner or not. Examples of common processing procedures are collection, recording, organization, structuring, storage, adaptation, transfer or erasure.

What personal data do we collect about you and for what purpose (why)?

To assess applications for published job vacancy and to determine whether we would like to offer you a position at Oatly.

Processing that is carried out

Collection of applications and the appraisal/disposal in relation to the requirements in job advert
Collection of data from third parties and public sources, such as Facebook and LinkedIn
Review and selection of applicants for interview
Candidates are called for an interview
Potential tests of candidates and reference checks
Selection of candidate

Category of personal data

Oatly has no specific requirements regarding which personal data is to be included in an application. The personal data processed normally includes:

Name
Contact details (address, email and telephone number)
CV data (such as current work position and any photos included therein)
Test results
Data published on social media
Input from references
Test results
Data published on social media

Purpose

To handle incoming spontaneous applications/ letters of interest and save applications and other data for future recruitment processes.

Processing that is carried out

Applications/letters are stored in order to be matched against future open positions. Furthermore, applications and other data collected in relation to a specific recruitment process (regarding a position which has been assigned to another applicant) may be stored in order to be matched against future open positions.

Category of personal data

Oatly has no specific requirements regarding which personal data is to be included in spontaneous job application. The personal data processed normally includes:

• Name

• Contact details (address, email and telephone number)

• CV data (such as current work position and any photos included therein)

What are the legal grounds for processing your personal data? The legal basis for processing personal data which we receive in relation to a recruitment process regarding an announced open position, or if you proceed to a job interview following an unsolicited application, is that the processing is necessary in order to take steps prior to entering into a (employment) contract with you.

The legal basis for processing personal data which we receive through an unsolicited application where we currently do not have any open positions to offer, or which we store after a completed recruitment process (regarding a position which has been assigned to another applicant) is the consent given by you to such processing.

For how long do we store your personal data? The application documents of dismissed candidates are stored until the expiration of the applicable appeal period, for example in accordance with anti-discrimination legislation.

If our processing of personal data is based on your consent, we will retain your personal data until you withdraw your consent. However, we will under all circumstances delete your personal data if the purpose behind our processing of such data ceases.

Who do we share your personal data with?

Only those of Oatly’s employees and, if applicable, external recruiters who are directly involved in a relevant recruitment process will have access to your personal data.

Furthermore, we may engage data processors for processing of your personal data, when it is necessary for us to offer our services or fulfill our commitments to you. Data processors are companies that process data on our behalf and according to our instructions. For the handling of job applications and processing of personal data in relation to recruitment processes, Oatly has engaged Teamtailor AB, a provider of an IT-system for e.g. collection of job applications and communication with applicants, as data processor.

When your personal data is shared with a data processor, it is only for purposes that are compatible with the purposes for which we have collected the data. We have written agreements with all our data processors through which they guarantee the security of the personal data processed and undertake to comply with our security requirements as well as restrictions and requirements regarding the international transfer of personal data.

Personal data may also be disclosed by us if it is necessary to comply with applicable legal or governmental requirements, to safeguard our legal interests or to detect, prevent or be attentive to fraud and other security or technical issues.

Where do we process your personal data?

We always strive for the processing of your personal data to take place within the EU/EEA. However, we may be required to transfer the data to a non-EU/EEA country, for example if we share your personal data with a data processor who, either themselves or through a sub-supplier, is established or stores data in a non-EU country. In this case, the data processor shall only be granted access to data relevant to the purpose. Regardless of the country in which your personal data is processed, we take all the necessary legal, technical and organizational measures to ensure that the level of protection is the same as within the EU/EEA.

In cases where personal data is processed outside the EU/EEA, the level of protection is guaranteed either by a decision of the EU Commission that the country concerned ensures an adequate level of protection or through the use of so-called appropriate safeguards. Examples of appropriate safeguards are: approved code of conduct in the destination country, standard contract clauses, or Binding Corporate Rules (BCRs).

What are your rights as data subject?

Right of access (Subject Access Request). We are always open and transparent about how we process your personal data and, if you require further information regarding which personal data we process about you in particular, you can request access to a copy of such data. Please note that if we receive a subject access request, we may ask for additional data to ensure the effective handling of your request and that the information is given to the correct person.

Right to rectification. If your personal data is incorrect, you may request its correction. Within the stated purpose, you also have the right to supplement any incomplete personal data.

Oatly may also, on its own initiative, correct, disassociate, delete or supplement data that is found to be incorrect, incomplete or misleading.

Right to erasure. You may request the deletion of the personal data we process about you if: - The data is no longer necessary for the purposes for which it has been collected or processed. - The personal data is processed in an unlawful way. - The personal data must be deleted to comply with a legal obligation we are subject to.

- Withdraw your consent (see below).

Please note that we may have the right to deny your request if the processing is necessary for us to determine, enforce or defend legal claims. Should we be prevented from meeting a request for deletion, we will instead block personal data from being used for purposes other than the purpose that prevents the requested deletion.

Right to withdraw consent. If Oatly processes personal data based on your consent, you have the right to withdraw the consent at any time through a written notice sent to the Oatly company that is responsible for the processing of your personal data.

Right to restriction. You may, in some cases, have the right to demand that the processing of your personal data is limited. By limitation, it means that the data is marked so that in future it will only be processed for certain limited purposes.

The right to restriction applies, inter alia, to the fact that the data is incorrect and relates to a request for it to be corrected. In such cases, you may also request that the data processing is restricted during the time that the data is being corrected.

If processing is restricted, we may, in addition to storage, only process the data in order to apply or defend legal claims to protect someone else's rights or if you have given your consent.

Right to data portability. If our right to process your personal data is based on your consent or performance of an agreement with you, you have the right to request for the data that relates to you and which you have provided to us to be transferred to another data controller (so-called data portability). A prerequisite for data portability is that the transfer is technically feasible and can be automated.

How is your personal data protected?

We have taken appropriate technical and organizational security measures to protect your personal data against unlawful and unauthorized processing, e.g. we use IT-systems to protect the privacy, integrity and availability of personal data for which we are data controller.

What can you do if you are dissatisfied with our processing of your personal data?

Should you be dissatisfied with our processing of your personal data, please let us know, and we will do our best to meet your complaints. Your integrity is very important to us, and we always strive to protect and secure your personal data in the best possible way. Should we nevertheless, in your opinion, fail in this ambition, please note that you are also entitled to lodge a complaint with the relevant supervisory authority, which may be found below.

Oatly companies:

Havre Global AB (559081-1989), Stora Varvsgatan 6a, 211 19 Malmö, Sweden, +46(418 47 55 00)

Group Finance and Controlling, IT and Corporate Management in Sweden

Oatly EMEA AB (559163-7698), Stora Varvsgatan 6a, 211 19 Malmö, Sweden, +46(418 47 55 00)

Oalty’s sales organization in Sweden

Oatly AB (556446-1043), Stora Varvsgatan 6a, 211 19 Malmö, Sweden, +46(418 47 55 00)

Global Operations Quality, Projects and Engineering, Innovation, Creative, Market insight & Business development, HR, Communication, Production in Sweden

Oatly UK Limited (8038012)

Oalty's organization in the UK

81 Rivington St, EC2A 3AY,London, UK

Oatly Germany GmbH, (41/748/04309)

Oalty's organization in Germany

Kurfürstendamm 11, 10719 Berlin Germany

Oy Oatly AB, 2858489-6,

Oalty's organization in Finland

Ludviginkatu 6, 00130, Helsinki, Finland

Oatly Netherlands B.V (73642746),

Oalty's commercial business in the Netherlands

A'DAM&Co, 1031 KS Amsterdam, Netherlands